- Test - lists.nanog.org

Internet Connectivity
by Jack Vizelter 01 Oct '04

01 Oct '04

We had several machines start spewing huge amounts of data causing our pipe to the public Internet to stop. We had no traffic coming in or out of the campus. We're unsure of whether it's virus related, but wanted to inquire if anyone else has heard of or came across something similar. It appears to be an DDOS attack, but, originating from the inside. This started last night at about 10pm EST. Thanks, -jack

1 0

The Cidr Report
by cidr-report＠potaroo.net 01 Oct '04

01 Oct '04

This report has been generated at Fri Oct 1 21:49:32 2004 AEST. The report analyses the BGP Routing Table of an AS4637 (Reach) router and generates a report on aggregation potential within the table. Check http://www.cidr-report.org/as4637 for a current version of this report. Recent Table History Date Prefixes CIDR Agg 24-09-04 144324 99990 25-09-04 145885 99946 26-09-04 145618 100026 27-09-04 145573 100092 28-09-04 145705 100057 29-09-04 145910 100061 30-09-04 145918 100047 01-10-04 145932 100217 AS Summary 18075 Number of ASes in routing system 7338 Number of ASes announcing only one prefix 1385 Largest number of prefixes announced by an AS AS7018 : ATTW AT&T WorldNet Services 86715392 Largest address span announced by an AS (/32s) AS721 : DNIC DoD Network Information Center Aggregation Summary The algorithm used in this report proposes aggregation only when there is a precise match using the AS path, so as to preserve traffic transit policies. Aggregation is also proposed across non-advertised address space ('holes'). --- 01Oct04 --- ASnum NetsNow NetsAggr NetGain % Gain Description Table 146170 100217 45953 31.4% All ASes AS18566 743 7 736 99.1% CVAD Covad Communications AS4134 813 177 636 78.2% CHINANET-BACKBONE No.31,Jin-rong Street AS4323 795 221 574 72.2% TWTC Time Warner Telecom AS7018 1385 964 421 30.4% ATTW AT&T WorldNet Services AS22773 402 21 381 94.8% CXA Cox Communications Inc. AS6197 774 411 363 46.9% BNS-14 BellSouth Network Solutions, Inc AS6467 391 30 361 92.3% ACSI e.spire Communications, Inc. AS27364 394 36 358 90.9% ARMC Armstrong Cable Services AS701 1253 905 348 27.8% UU UUNET Technologies, Inc. AS22909 381 42 339 89.0% CMCS Comcast Cable Communications, Inc. AS1239 952 636 316 33.2% SPRN Sprint AS17676 368 56 312 84.8% JPNIC-JP-ASN-BLOCK Japan Network Information Center AS9929 334 33 301 90.1% CNCNET-CN China Netcom Corp. AS6478 370 74 296 80.0% ATTW AT&T WorldNet Services AS4355 381 99 282 74.0% ERSD EARTHLINK, INC AS21502 268 3 265 98.9% ASN-NUMERICABLE NUMERICABLE is a cabled network in France, AS4766 529 266 263 49.7% KIXS-AS-KR Korea Telecom AS14654 260 6 254 97.7% WAYPOR-3 Wayport AS6140 368 115 253 68.8% IMPSA ImpSat AS9443 358 109 249 69.6% INTERNETPRIMUS-AS-AP Primus Telecommunications AS7843 489 251 238 48.7% ADELPH-13 Adelphia Corp. AS2386 840 611 229 27.3% ADCS-1 AT&T Data Communications Services AS1221 812 584 228 28.1% ASN-TELSTRA Telstra Pty Ltd AS25844 244 16 228 93.4% SASMFL-2 Skadden, Arps, Slate, Meagher & Flom LLP AS9583 530 308 222 41.9% SIFY-AS-IN Sify Limited AS6198 427 211 216 50.6% BNS-14 BellSouth Network Solutions, Inc AS15557 339 126 213 62.8% LDCOMNET LDCOM NETWORKS AS13083 217 8 209 96.3% Mannesmann Datenverarbeitung Autonomes System AS721 722 516 206 28.5% DNIC DoD Network Information Center AS6327 229 29 200 87.3% SHAWC-2 Shaw Communications Inc. Total 16368 6871 9497 58.0% Top 30 total Possible Bogus Routes 24.138.80.0/20 AS11260 AHSICHCL Andara High Speed Internet c/o Halifax Cable Ltd. 24.246.0.0/17 AS7018 ATTW AT&T WorldNet Services 24.246.38.0/24 AS25994 NPGCAB NPG Cable, INC 24.246.128.0/18 AS7018 ATTW AT&T WorldNet Services 64.46.4.0/22 AS11711 TULARO TULAROSA COMMUNICATIONS 64.46.27.0/24 AS8674 NETNOD-IX Netnod Internet Exchange Sverige AB 64.46.34.0/24 AS3408 64.46.63.0/24 AS7850 IHIGHW iHighway.net, Inc. 64.83.96.0/19 AS26956 NETFR NetFree Communications 64.127.0.0/18 AS7018 ATTW AT&T WorldNet Services 66.114.0.0/19 AS16526 BIRCHT Birch Telecom, Inc. 69.26.32.0/19 AS17307 VIRTEL-15 Virtela Communications 111.0.0.0/24 AS7563 KII-AS Korea Internet Infrastructure 132.0.0.0/10 AS721 DNIC DoD Network Information Center 137.0.0.0/13 AS721 DNIC DoD Network Information Center 138.136.0.0/13 AS721 DNIC DoD Network Information Center 158.0.0.0/13 AS721 DNIC DoD Network Information Center 192.30.93.0/24 AS17757 HPAUS-AP HP Australia 192.30.94.0/24 AS17757 HPAUS-AP HP Australia 192.30.127.0/24 AS719 LANLINK Elisa Oyj 192.40.105.0/24 AS5515 SONERA-GLOBAL-IP Sonera Solution Autonomous System 192.44.0.0/19 AS702 AS702 MCI EMEA - Commercial IP service provider in Europe 192.70.164.0/24 AS25689 NRCC-2 National Research Council of Canada 192.80.64.0/19 AS1 LVLT Level 3 Communications, Inc. 192.81.182.0/24 AS719 LANLINK Elisa Oyj 192.81.183.0/24 AS719 LANLINK Elisa Oyj 192.81.184.0/24 AS719 LANLINK Elisa Oyj 192.107.144.0/22 AS1 LVLT Level 3 Communications, Inc. 192.119.135.0/24 AS270 NASA National Aeronautics and Space Administration 192.124.252.0/22 AS680 DFN-IP service G-WiN 192.133.6.0/24 AS4004 GLOBALONE-EQUANT-UK Equant UK & Greece Autonomous System 192.135.50.0/24 AS7018 ATTW AT&T WorldNet Services 192.138.208.0/20 AS1 LVLT Level 3 Communications, Inc. 192.153.144.0/21 AS721 DNIC DoD Network Information Center 192.172.0.0/19 AS721 DNIC DoD Network Information Center 192.188.208.0/20 AS721 DNIC DoD Network Information Center 192.190.16.0/21 AS1 LVLT Level 3 Communications, Inc. 192.243.32.0/23 AS2044 PALINA Palin Aquisitions Inc. 196.2.95.0/24 AS8668 TELONE-AS TelOne Zimbabwe P/L 198.23.26.0/24 AS4390 BELLAT-7 Bell Atlantic, Inc. 198.97.72.0/21 AS721 DNIC DoD Network Information Center 198.97.80.0/20 AS721 DNIC DoD Network Information Center 198.97.88.0/24 AS89 NUSC-1 Naval Underwater Systems Center 198.97.240.0/20 AS721 DNIC DoD Network Information Center 198.97.247.0/24 AS3475 DEPART-52 Department of the Navy 198.101.4.0/22 AS721 DNIC DoD Network Information Center 198.136.32.0/20 AS19329 MCBCC Martin County Board of County Commissioners 198.144.32.0/19 AS3998 CITY CityNet, Inc. 198.161.87.0/24 AS6539 GTGR GT Group Telecom Services Corp. 198.161.165.0/24 AS852 AGTA Telus Advanced Communications 198.163.155.0/24 AS684 MRN Manitoba Regional Network 198.167.0.0/16 AS7456 INS-51 Interhop Network SERVICES Inc. 198.167.163.0/24 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 198.168.0.0/16 AS701 UU UUNET Technologies, Inc. 198.169.0.0/16 AS803 SASK SaskTel 198.232.133.0/24 AS23075 SKOTOS Skotos Tech, Inc 199.10.0.0/16 AS721 DNIC DoD Network Information Center 199.60.0.0/20 AS271 UBC-3 University of British Columbia 199.96.44.0/23 AS19092 360NE-1 360Networks (USA) Inc. 199.96.46.0/24 AS19092 360NE-1 360Networks (USA) Inc. 199.114.0.0/18 AS568 DISOUN DISO-UNRRA 199.114.0.0/21 AS721 DNIC DoD Network Information Center 199.114.128.0/18 AS721 DNIC DoD Network Information Center 199.114.130.0/24 AS721 DNIC DoD Network Information Center 199.114.132.0/24 AS721 DNIC DoD Network Information Center 199.114.134.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.136.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.138.0/24 AS721 DNIC DoD Network Information Center 199.114.140.0/24 AS3544 DISAUN DISA/UNRRA 199.114.142.0/24 AS721 DNIC DoD Network Information Center 199.114.144.0/24 AS721 DNIC DoD Network Information Center 199.114.148.0/24 AS721 DNIC DoD Network Information Center 199.114.150.0/24 AS721 DNIC DoD Network Information Center 199.114.152.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.154.0/24 AS1733 ADP-41 AF DDN PMO 199.114.156.0/24 AS1913 DLA-8 Defense Logistics Agency 199.114.160.0/24 AS1733 ADP-41 AF DDN PMO 199.120.32.0/19 AS16582 NXLI NEXTLEVEL INTERNET, INC. 199.121.0.0/16 AS721 DNIC DoD Network Information Center 199.123.0.0/18 AS721 DNIC DoD Network Information Center 199.123.16.0/20 AS721 DNIC DoD Network Information Center 199.123.80.0/21 AS721 DNIC DoD Network Information Center 199.189.32.0/19 AS7332 IQUEST IQuest Internet 199.197.8.0/22 AS21814 PARSON-18 Parsons Corp. 199.202.0.0/16 AS701 UU UUNET Technologies, Inc. 202.47.1.0/24 AS7491 PI-PH-AS-AP PI-PHILIPINES 202.70.28.0/24 AS4515 ERX-STAR Star Internet Services Ltd. 202.73.128.0/22 AS4058 LINKAGENET-AP CPCNet Hong Kong Ltd. 202.81.96.0/19 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.81.109.0/24 AS7657 TIG-US-PAS-AP The Internet Group Limited 202.81.121.0/24 AS10113 DATAFAST-AP DATAFAST TELECOMMUNICATIONS LTD 202.93.0.0/20 AS4134 CHINANET-BACKBONE No.31,Jin-rong Street 202.133.3.0/24 AS9335 CIP-JAPAN-AS-AP ATT IPlus 202.164.224.0/19 AS7599 IPXC-AS-AP IP Exchange 203.32.4.0/23 AS7617 203.62.0.0/17 AS7572 AARNET-ACT-RNO Australian Academic and Reasearch Network (AARNet) 203.84.192.0/19 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.192.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.84.208.0/20 AS17433 PHILWEB-AP PhilWeb.Com, Inc. 203.210.69.0/24 AS17536 PRODIGY-AS-AP Prodidgy Telecommunications 204.154.125.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.126.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.154.127.0/24 AS3952 TELLAB-1 TELLABS Operations, Inc. 204.194.110.0/23 AS30653 EXOBI Exobit Networks Inc. 204.196.0.0/14 AS1 LVLT Level 3 Communications, Inc. 205.150.0.0/15 AS701 UU UUNET Technologies, Inc. 205.159.72.0/24 AS1660 ANSCOM-5 ANS Communications 206.167.57.0/24 AS376 RISQR-3 Reseau Interordinateurs Scientique Quebecois (RISQ) 206.191.64.0/18 AS15290 ACCA-2 Allstream Corp. Corporation Allstream 206.251.69.0/24 AS27429 TIL-33 Telesat International Ltd. 206.253.190.0/23 AS8123 POLYBA Polybase 207.231.96.0/19 AS11194 NUNETI NuNet Inc 208.81.187.0/24 AS19194 SNL-8 Sentris Network LLC 209.143.192.0/18 AS3561 CWU Cable & Wireless USA 209.172.0.0/18 AS7770 TRTI Triton Technologies, Inc. 209.205.69.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.70.0/24 AS21578 Universidad autonoma de Bucaramanga 209.205.81.0/24 AS15066 SkyNet de Colombia S.A. 209.205.82.0/24 AS15066 SkyNet de Colombia S.A. 209.205.84.0/24 AS15066 SkyNet de Colombia S.A. 209.213.32.0/19 AS10629 INS-52 Inter-Pacific Network Services 209.213.48.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.49.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.50.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.51.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.55.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.213.56.0/24 AS10629 INS-52 Inter-Pacific Network Services 209.251.0.0/19 AS11036 SISCOM-1 SISCOM, Inc 216.37.110.0/23 AS4264 CERFN California Education and Research Federation Network 216.96.128.0/18 AS7018 ATTW AT&T WorldNet Services 216.145.130.0/24 AS11937 TRXI TRX Inc. 216.145.132.0/24 AS11937 TRXI TRX Inc. 216.145.134.0/24 AS11937 TRXI TRX Inc. 216.145.156.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.158.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.176.0/21 AS20304 JIS-32 JVLNET Internet Services 216.145.177.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.178.0/24 AS20304 JIS-32 JVLNET Internet Services 216.145.184.0/21 AS10758 INWAVE INWave Internet, Inc 216.145.200.0/21 AS20304 JIS-32 JVLNET Internet Services 216.186.151.0/24 AS3356 LEVEL3 Level 3 Communications 216.186.152.0/21 AS3356 LEVEL3 Level 3 Communications 216.186.160.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.164.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.192.0/22 AS3356 LEVEL3 Level 3 Communications 216.186.198.0/23 AS3356 LEVEL3 Level 3 Communications 216.186.248.0/23 AS3356 LEVEL3 Level 3 Communications Please see http://www.cidr-report.org for the full report ------------------------------------ Copies of this report are mailed to: nanog(a)merit.edu eof-list(a)ripe.net apops(a)apops.net routing-wg(a)ripe.net afnog(a)afnog.org swinog(a)swinog.ch

1 0

RE: Blackhole Routes
by Matt Ryan 01 Oct '04

01 Oct '04

Something like http://www.cisco.com/en/US/products/ps5888/index.html? Matt. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Bill Stewart Sent: 01 October 2004 08:23 To: Eric Germann; nanog(a)merit.edu Subject: Re: Blackhole Routes On Thu, 30 Sep 2004 10:35:36 -0400, Eric Germann <ekgermann(a)cctec.com> wrote: > What I would to see (and have never researched in depth) is a way to apply > the blackhole routes on a community to port basis (i.e. we set up a specific > BGP community to filter mail, and that community goes to a route map that > kills only port 25, another community applies to a map that kills port 80, A not particularly scalable method of doing that, which should be ok for small data flows, is to set up routers port25killer.example.net, a port80killer.example.net, etc., with ACLs that block those ports regardless of address, use BGP or OSPF to advertise whichever IP address spaces should be routed there, and set up those machines in whatever sort of firewalling location makes sense. It's more of an enterprise solution than an ISP solution, but if you're a small ISP or dealing with a relatively specific set of problem sites you could probably do it. You may need to burn some CPE on GRE tunnels, depending on your topology, but if you're trying to solve a limited problem like letting your users access Korean web sites while blocking Korean email, it may work. ------------------------------------------------------------------------------ Live Life in Broadband www.telewest.co.uk The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Statements and opinions expressed in this e-mail may not represent those of the company. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender immediately and delete the material from any computer. ==============================================================================

1 0

ddos attack advice
by adrian kok 30 Sep '04

30 Sep '04

Dear all I have ddos attack to our ip A.B.C.D yesterday. Someone suggest me to post it here and I might get advice from this newsgroup 1/ What's good methodology in blocking certain IP address? ACL or strictly filtering list, Which one is better? or some other effective ways also? 2/ We could act immediately to block the IP address at our firewall; but the load is still in our end (from the machine A.B.C.D trasnfered to our firewall) Then we also asked our uptream ISP to block it, the load should be at their end. How does ISP handle the sudden bandwidth resulted from a DDOS attack. Thank you

1 0

(OT): need QWEST NOC contact
by Rich Sena 30 Sep '04

30 Sep '04

Please contact me off-list -- Rich Sena - ras(a)thick.net ThickNET Consulting "On the way to understanding; you understand, and forget."

1 0

RE: Earthquake in Northern California
by Dave Hilton 30 Sep '04

30 Sep '04

Foster City (zip 94404) The Liquidation Capital of Northern California. There was some mild rolling, window blinds swaying, minor ripples in the coffee cup. Not enough to knock our 172.16 down to 86.8 Dave Hilton Staff System Administrator entelos(r) Foster City, CA "Notice: I tend to become apprehensive when my position in the food chain becomes ambiguous."

10 12

RE: Open-Source Network Management Tools
by JDeane＠sungardfutures.com 30 Sep '04

30 Sep '04

The one item I've found missing in the open source NMS tools I've examined is functional and aesthetically pleasing mapping, i.e. the big picture network map with ability to drill down. If anyone has found a nifty solution for this please let me know! Regards, Jade Jade E. Deane Senior Network Engineer SunGard Futures Systems SunGard Systems International, Inc. jdeane(a)sungardfutures.com +1 (312) 577-6100 +1 (866) 741-0076 (Fax)

3 2

Re: Open-Source Network Management Tools
by Pete Hoffswell 29 Sep '04

29 Sep '04

You can also look at NMIS http://www.sins.com.au/nmis/ Pete Hoffswell 616-732-1101 (Grand Rapids, x1101) University LAN/WAN Coordinator 616-510-1198 (Mobile) IT Services pete.hoffswell(a)davenport.edu Davenport University http://www.davenport.edu -=-=- LAN/WAN services: http://networker.davenport.edu -=-=- >>> "Claydon, Tom" <Tom.Claydon(a)DobsonTelco.net> 9/14/2004 3:47:45 PM >>> I'm looking for open-source alternatives for network management, such as Nagios or Big Brother. We are currently using WhatsUp Gold, and would like to move to something more flexible (and not running on a Windows platform). Something that has email/paging capabilities, and can process SNMP traps would be a plus for us as well. Recommendations? Thanks.

2 1

OT: Slowing the speed of light to improve networking?
by Fergie (Paul Ferguson) 29 Sep '04

29 Sep '04

A colleague brought this article to my attention. Slightly off-topic, but interesting nonetheless: "Researchers at UC Berkeley, along with scientists from the University of Oregon and the University of Illinois, say they can slow the speed of light in a way that could help speed the delivery of movies to your PC. "Scientists at the university managed to slow the speed of light traveling through a semiconductor to 6 miles a second, or 31,000 times slower than the 186,000 miles per second that light normally travels in a vacuum. "Slowing the light pulses could lead to a more orderly traffic flow in networks, ....." Full article: http://news.com.com/Slowing+the+speed+of+light+to+improve+networking/2100-1… - ferg -- "Fergie", a.k.a. Paul Ferguson Engineering Architecture for the Internet fergdawg(a)netzero.net or fergdawg(a)sbcglobal.net

1 0

RE: 10GE access switch router
by Temkin, David 29 Sep '04

29 Sep '04

Bill, With the right amount of prep work and understanding of how the stacking works, you can control everything you complained about. I complained about the same stuff until I read the document that explains how to: 1) Renumber a switch in the cluster (and all of it's interfaces with it) 2) Hot swap a new switch into the cluster 3) - and this one's sweet - upgrade the s/w on the entire cluster in one shot, even if they're different models 4) Control which switch is the master so that adding a new switch to the stack doesn't chance screwing up your configs. 5) Permanently remove all stacking config from the switch The actual backplane has lived up performance wise in the testing I've done, but I haven't come anywhere near testing it to 32gbps. Just the same as thousands of people have wiped out every VLAN on their network by putting in a switch with a higher VTP revision number with no VLANs defined, it takes a learning curve to work well with these suckers. Granted - the software has been somewhat buggy - but those aren't the merits I'm debating. http://www.cisco.com/en/US/customer/products/hw/switches/ps5023/products _configuration_guide_chapter09186a00801a6558.html > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On > Behalf Of Bill Woodcock > Sent: Wednesday, September 29, 2004 11:33 AM > To: Deepak Jain > Cc: Frederic NGUYEN; nanog(a)merit.edu > Subject: Re: 10GE access switch router > > > On Tue, 28 Sep 2004, Deepak Jain wrote: > > Just a note, if you want redundant 10GE uplinks you > need to get two of > > these and stack them. The stacking interface does not > reduce the amount > > of switching bandwidth to the front ports IIRC. > > ...and the stacking interface is actually pretty lousy, from > our testing. > We were anticipating really liking it, but we haven't touched > it again, since our lab work. Obviously it precludes > hot-swappability, but beyond that, using it wipes any > preexisting configuration on all but the first box (and out > of two, I don't know how to predict which it will decide is > first, in advance), and it leaves the port-numbering screwed > up on any boxes that have used it, in perpetuity. > > -Bill > > > IMPORTANT: The information contained in this email and/or its attachments is confidential. If you are not the intended recipient, please notify the sender immediately by reply and immediately delete this message and all its attachments. Any review, use, reproduction, disclosure or dissemination of this message or any attachment by an unintended recipient is strictly prohibited. Neither this message nor any attachment is intended as or should be construed as an offer, solicitation or recommendation to buy or sell any security or other financial instrument. Neither the sender, his or her employer nor any of their respective affiliates makes any warranties as to the completeness or accuracy of any of the information contained herein or that this message or any of its attachments is free of viruses.

2 1